CVE-2025-0068 Overview
CVE-2025-0068 is a missing authorization vulnerability [CWE-862] in SAP NetWeaver Application Server ABAP. An obsolete functionality within the platform fails to perform required authorization checks before returning data. An authenticated attacker with low privileges can query the affected component over the network and retrieve information that should remain restricted. The flaw does not affect integrity or availability of the application, only confidentiality. SAP addressed the issue on its January 2025 Security Patch Day through SAP Note 3550674.
Critical Impact
Authenticated attackers can access restricted information from SAP NetWeaver Application Server ABAP by invoking an obsolete function that skips authorization enforcement.
Affected Products
- SAP NetWeaver Application Server ABAP
- ABAP-based SAP business applications relying on the affected component
- Environments exposing the obsolete functionality to authenticated business users
Discovery Timeline
- 2025-01-14 - CVE-2025-0068 published to the National Vulnerability Database
- 2025-01-14 - SAP released SAP Note 3550674 on the January 2025 Security Patch Day
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-0068
Vulnerability Analysis
The vulnerability resides in an obsolete function shipped with SAP NetWeaver Application Server ABAP. The function returns data to callers without validating whether the requesting user is authorized to view it. An authenticated attacker with a low-privileged account can invoke the routine over the network and receive information intended for privileged roles.
The issue is classified as Missing Authorization [CWE-862]. Because the check is absent rather than incorrectly implemented, exploitation requires no bypass technique. The attacker simply calls the exposed functionality using valid session credentials.
Impact is limited to confidentiality. The vulnerability does not permit modification of business data, configuration changes, or service disruption. The current EPSS probability is 0.271%, placing it in the 19th percentile for likelihood of exploitation.
Root Cause
SAP retained legacy functionality in NetWeaver AS ABAP that predates the current authorization model. The affected code path does not invoke an AUTHORITY-CHECK statement before returning results, so any authenticated principal can request data regardless of assigned roles or authorization objects.
Attack Vector
Exploitation requires network access to the SAP application server and a valid low-privilege ABAP user account. No user interaction is needed. The attacker calls the obsolete function through supported ABAP interfaces to retrieve restricted information. Refer to SAP Note 3550674 for the specific component and function identifiers.
No public proof-of-concept code is available for this issue. The vulnerability is described in prose only because SAP has not published exploitation details.
Detection Methods for CVE-2025-0068
Indicators of Compromise
- Repeated calls to the deprecated function identified in SAP Note 3550674 from low-privileged accounts
- ABAP audit log entries showing information retrieval without corresponding authorization object checks
- Unusual RFC or SAP GUI activity from service accounts that normally do not access reporting functions
Detection Strategies
- Enable the SAP Security Audit Log (SM19/RSAU_CONFIG) and monitor for invocations of the deprecated function referenced in the patch
- Correlate ABAP function calls with user role assignments to surface access that bypasses expected authorization objects
- Review Read Access Logging (RAL) configurations to capture sensitive data reads from unexpected sources
Monitoring Recommendations
- Forward SAP audit logs to a centralized analytics platform for long-term retention and correlation
- Baseline normal function-module call patterns per user role and alert on statistical deviations
- Track cumulative data access volumes per user to detect enumeration behavior consistent with information disclosure
How to Mitigate CVE-2025-0068
Immediate Actions Required
- Apply the SAP patch referenced in SAP Note 3550674 to affected NetWeaver AS ABAP systems
- Review recent audit logs for unauthorized calls to the deprecated function before patching
- Restrict network exposure of SAP application servers to trusted business networks only
Patch Information
SAP released the fix on the January 2025 Security Patch Day. Administrators should download and apply SAP Note 3550674 following standard change control procedures. Additional advisories are listed on the SAP Security Patch Day portal.
Workarounds
- Remove or restrict authorizations that allow low-privileged users to invoke the deprecated function until the patch is applied
- Disable or block access to the obsolete functionality identified by SAP if it is not required for business operations
- Enforce strong authentication and session controls to limit which accounts can reach the vulnerable interface
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
